Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

MEDIUM 4.3CVE-2024-39460 · GHSA-x8mf-jcmf-r79f · Published 26/06/2024 · updated 17/06/2026

In short

CVE-2024-39460 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source, bitbucket branch source (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.1% of all vulnerabilities.
Fix: update to 887.va or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source Maven	`< 887.va`	`887.va`
bitbucket branch source jenkins	`≤ 886.v44cf5e4ecec5`	No fix yet

Description

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.

NVD description

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

References

nvd.nist.gov/vuln/detail/CVE-2024-39460 · ADVISORY
jenkinsci/bitbucket-branch-source-plugin commit ad359b3 · WEB
jenkinsci/bitbucket-branch-source-plugin · PACKAGE
jenkins.io/security/advisory/2024-06-26 · WEB
openwall.com/lists/oss-security/2024/06/26/2 · WEB

More vulnerabilities in org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

Maven

< 887.va

887.va

bitbucket branch source

jenkins

≤ 886.v44cf5e4ecec5

No fix yet

Description

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.

NVD description

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

More vulnerabilities in org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

See all →